Privacy policy

1. Applicability and scope

This Privacy Policy is issued by Hubb Rewards Private Limited ("Hubb", "we", "our", or "us"), a company incorporated under the laws of India with its registered office at B-13/7, DLF Phase 1, Gurgaon, Haryana 122002. It describes how we collect, use, disclose, and protect your personal data when you access or use the Hubb platform, including the Hubb customer app (the "App"), the Hubb merchant dashboard (the "Dashboard"), and our website at hubbrewards.com (collectively, the "Platform").

This Privacy Policy must be read together with our Terms of Use and all other Platform Policies. In the event of any inconsistency in relation to the processing of personal data, this Privacy Policy shall prevail to the extent of the inconsistency.

This Privacy Policy applies to (a) Customers using the App to discover businesses, attend Events, and earn or redeem Hubb Points; and (b) Merchants, store managers, employees, Hosts, and authorised representatives accessing or using the Dashboard.

For the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the Data Fiduciary and you are the Data Principal in respect of the personal data we collect from you, except as set out below:

• Where you input, upload, or submit the personal data of any third party onto the Platform (for example, when you invite another person to an Event or share their contact details), you are the Data Fiduciary in respect of that data and we act as a Data Processor on your behalf and on your instructions.
• Where an Event is hosted by a brand Partner or a verified non-brand Host and we process attendee data on their instructions in connection with that Event, the Host is a Data Fiduciary in respect of that data. We encourage you to review the Host's own privacy terms where they are made available to you before you RSVP or book.

By accessing the Platform or using any Service, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data in accordance with it. If you do not agree, please do not use the Platform.

The Platform is not intended for individuals who have not completed eighteen (18) years of age. Where a person below that age accesses the Platform, we assume such access is undertaken with the consent of their parent or lawful guardian, who is deemed to consent to the processing of the child's personal data in accordance with this Privacy Policy and the DPDP Act.

You acknowledge that any personal data you voluntarily make public on the Platform (such as a public profile or a public review), and your presence and likeness where captured at an Event you attend, may be treated as personal data made publicly available by you.

2. Definitions

• "Data Fiduciary" means any person who, alone or with others, determines the purpose and means of processing of personal data.
• "Data Principal" means the individual to whom the personal data relates, and where that individual is a child, includes their parent or lawful guardian.
• "Data Processor" means any person who processes personal data on behalf of a Data Fiduciary.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Personal Data Breach" means any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data, that compromises its confidentiality, integrity, or availability.
• "Processing" means any operation performed on personal data, whether automated or not, including collection, storage, use, disclosure, sharing, and erasure.

Capitalised terms not defined here have the meaning given to them in the Terms of Use.

3. Information we collect and how we use it

We process your personal data only for lawful purposes connected with the functioning of the Platform. The table below sets out the categories of personal data we collect and the purposes for which we process them.

We do not process your personal data for any purpose other than those for which you have provided consent, unless such processing is permitted under Applicable Laws without consent. We do not use this information to target you with third-party advertisements, and we do not share individual usage data across Customers and Merchants.

4. Disclosure to third parties

We do not sell or rent your personal data. We disclose it only to the extent necessary to provide the Services or as permitted under Applicable Laws.

We may share your personal data with the following categories of recipients:

• Payment Service Providers, including RBI-authorised aggregators such as Razorpay, to process payments, refunds, and split settlements.
• Communication and messaging partners, to deliver one-time passwords, confirmations, receipts, service updates, and, where you have consented, promotional communications.
• Cloud hosting, storage, and analytics providers, to host and operate the Platform and understand and improve its performance, bound by confidentiality obligations.
• Event Hosts, being brand Partners or verified non-brand Hosts, where you RSVP to or book their Event, limited to the data necessary to confirm and manage your attendance.
• Governmental, regulatory, judicial, or law-enforcement authorities, where required or permitted under Applicable Laws.

All third parties with whom we share personal data are contractually bound to process it only for the purposes for which it was shared, to implement reasonable security safeguards, and to comply with Applicable Laws.

5. Cross-border data transfers

Personal data is stored on servers located in India. Where any Data Processor we engage processes your personal data outside India, we ensure such transfer is subject to appropriate contractual safeguards requiring protection to a standard no less than that required under Applicable Laws. By continuing to use the Platform, you consent to such transfers.

6. Cookies and tracking technologies

When you access the Platform, we may place cookies and similar technologies on your device. These may be session-based or persistent. We use first-party cookies that are essential to keep you logged in and maintain your session and preferences, and we may use analytics cookies to understand feature usage and improve the Platform.

You can disable cookies through your browser settings; some features may not function correctly if you do so.

7. Reasonable security safeguards

We maintain reasonable security safeguards to protect your personal data in line with industry standards and Applicable Laws. These include encryption of data in transit, one-time-password verification, role-based access controls, audit logs, and monitoring to detect and remediate unauthorised access. Access to personal data is restricted to personnel and partners who need it and who are subject to confidentiality obligations.

We review our safeguards periodically. However, no system is completely secure, and we cannot guarantee absolute security. If you believe your account or personal data has been compromised, please notify us immediately using the contact details in Clause 12.

8. Data retention

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required for compliance with Applicable Laws, whichever is longer. Certain operational and transaction data may be retained for legal, tax, and audit purposes.

Upon a valid request for erasure or withdrawal of consent, we will erase your personal data as soon as it is reasonable to conclude that the purpose is no longer being served and there is no legal obligation to retain it, and we will direct our Data Processors to do the same.

9. Personal data breach notification

In the event of a Personal Data Breach, we will notify you and the Data Protection Board of India as required under the DPDP Act, without undue delay, through your account or your registered contact details. Our notice to you will describe the nature of the breach, its likely consequences for you, the measures we are taking to mitigate it, the steps you may take to protect your interests, and a point of contact for further information.

10. Your rights

Subject to Applicable Laws, you have the following rights in relation to your personal data:

• Right to withdraw consent. You may withdraw consent for any purpose at any time, with the same ease with which it was given, through your account settings. Withdrawal does not affect the lawfulness of processing carried out before it.
• Right to access. You may request a summary of the personal data we process about you, the processing activities undertaken, and the identities of those with whom it has been shared.
• Right to correction and erasure. You may request correction of inaccurate or incomplete data, and erasure of your personal data where retention is not required for the specified purpose or by Applicable Laws.
• Right to grievance redressal. You may raise a grievance with us as set out in Clause 12, and to nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.

Where we process your personal data as a Data Processor on behalf of an Event Host, requests in relation to that data should be directed to the relevant Host as the Data Fiduciary, and we will assist the Host in responding in accordance with our contractual obligations.

11. Your duties

As a Data Principal, you agree to comply with Applicable Laws when exercising your rights, not to impersonate another person, not to suppress material information, not to raise false or frivolous grievances, and to furnish only authentic information. Where you submit the personal data of any third party onto the Platform, you confirm that you have obtained all necessary consents and informed that person of the processing, and you agree to indemnify us in respect of any claim arising from that data.

12. Contact us

If you have any question, concern, or grievance about this Privacy Policy or how we handle your personal data, you may contact:

We will acknowledge and endeavour to resolve grievances within a reasonable period not exceeding thirty (30) days from receipt.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in Applicable Laws. Where we make material changes, we will notify you through the Platform, your registered email address, or an in-app notification before they take effect. The "Last updated" date above indicates when it was most recently revised. Your continued use of the Platform after notification constitutes acceptance of the revised Privacy Policy.